lockfile_audit 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6f02ad30c5d73027023967b15462cf39489383751cd89acb440fb0c6eb993e70
-  data.tar.gz: a4d6a9fbd40231af0c64935759faf225f5891bb93a617723cc540bd1adacd2c2
+  metadata.gz: 5b293cff106a2d7cdf8214e512965e2d0155ac740d7d26eec9840c8d9634a795
+  data.tar.gz: f02bf84ccdd70a87cf2d7bada32ffcba4b343ff553cbc016a7c152df5e7b9f81
 SHA512:
-  metadata.gz: 7c0fc2776fe8bc32ae760225ac8d76ed805dc8e839fb85fb27d60aae31894608a41b6f341eecdef0e396149a7bc4bd8da7cf136ea79a782e53e73b018c73bbb9
-  data.tar.gz: 6b62f3b0e60043aa76e4bc771adb14082df5f36f6a2afe34f621dbc299b7f1bdc59852666e855f0c1bf6548e1442cd3468b5065cbbc80a2558b6b5b96f2ca03b
+  metadata.gz: 69158c852ae5786a6181f4df7f871accf34a3d42868a153a818186398bd188aad0f3d5ba7ebdfb1049d1c10692f0e57861f294f3ae6d335d0c5df4c9f88d7772
+  data.tar.gz: 3491f0634af4b8caea832f88e7eadfc5b71cf4e4db0dca98ae57a60e27a8c011125b7c42f66e9b2f1f98a8afa782279f4e249d561920e3f0697931f6a9bd6e3b

data/CHANGELOG.md

@@ -7,6 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.1] - 2026-09-26
+
+### Fixed
+
+- `VulnerabilityCollector` now invokes `bundle-audit` using the same Ruby
+  as the host application (`RbConfig.ruby`) and resolves the exact binary
+  path via `Gem.bin_path`, instead of relying on `PATH`. This prevents
+  `Bundler::RubyVersionMismatch` errors when the app's Ruby differs from
+  the one on `PATH`.
+- Added a missing `raise_not_installed` helper so the collector raises a
+  clear `BundlerAuditNotInstalled` error (with stderr detail) instead of
+  a `NoMethodError`.
+
 ## [0.1.0] - 2026-09-26
 
 ### Added
@@ -26,5 +39,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `LockfileAudit::Errors` namespace with `LockfileNotFound`,
   `BundlerAuditNotInstalled`, and `InvalidAuditJson`.
 
-[Unreleased]: https://github.com/Behnam1369/lockfile_audit/compare/v0.1.0...HEAD
+[Unreleased]: https://github.com/Behnam1369/lockfile_audit/compare/v0.1.1...HEAD
+[0.1.1]: https://github.com/Behnam1369/lockfile_audit/compare/v0.1.0...v0.1.1
 [0.1.0]: https://github.com/Behnam1369/lockfile_audit/releases/tag/v0.1.0

data/lib/lockfile_audit/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module LockfileAudit
-  VERSION = "0.1.0"
+  VERSION = "0.1.1"
 end

data/lib/lockfile_audit/vulnerability_collector.rb

@@ -15,13 +15,9 @@ module LockfileAudit
   #
   # When invoking the CLI, the collector runs with a scrubbed environment so
   # the parent process's Bundler state (BUNDLE_*, RUBYOPT, etc.) does not leak
-  # into the subprocess. Without this, running from inside a Rails console
-  # causes Bundler to re-validate the Ruby version in the subprocess and abort
-  # with Bundler::RubyVersionMismatch.
-  #
-  # The CLI is invoked directly (never via `bundle exec` or `gem exec`) so the
-  # subprocess stays independent of the parent's Bundler context and does not
-  # trigger dependency installation or RDoc generation as a side effect.
+  # into the subprocess. It also invokes bundler-audit using the *current*
+  # Ruby (RbConfig.ruby) and the exact installed binary path (Gem.bin_path),
+  # so the subprocess uses the same Ruby as the host application.
   class VulnerabilityCollector
     # Environment variables that must not leak into the bundler-audit
     # subprocess. These are set by Bundler when the parent process is a
@@ -76,28 +72,30 @@ module LockfileAudit
     private
 
     def run_bundler_audit
-      stdout, stderr, status = invoke(["bundle-audit"])
+      stdout, stderr, status = invoke
       return stdout if usable?(stdout, status)
 
+      raise_not_installed(stderr)
+    rescue Gem::Exception
       raise Errors::BundlerAuditNotInstalled,
-        "bundle-audit could not be invoked. " \
-        "Ensure the `bundler-audit` gem is installed and on your PATH " \
-        "(e.g. `gem install bundler-audit`). " \
-        "stderr: #{stderr.to_s.strip}"
+        "bundler-audit is not installed for #{RbConfig.ruby} (#{RUBY_VERSION}). " \
+        "Install it for this Ruby: gem install bundler-audit"
     rescue Errno::ENOENT
-      raise Errors::BundlerAuditNotInstalled,
-        "bundle-audit is not installed or not on PATH. " \
-        "Install it with `gem install bundler-audit`."
+      raise_not_installed(nil)
     end
 
-    def invoke(command)
+    def invoke
       Open3.capture3(
         clean_env,
-        *command, "check", "--format", "json",
+        RbConfig.ruby, bundle_audit_path, "check", "--format", "json",
         chdir: File.dirname(File.expand_path(@lockfile_path))
       )
     end
 
+    def bundle_audit_path
+      Gem.bin_path("bundler-audit", "bundle-audit")
+    end
+
     # Builds an environment hash that removes the inherited Bundler state.
     # Passing nil as the value to Open3 unsets the variable in the child.
     def clean_env
@@ -116,6 +114,18 @@ module LockfileAudit
       false
     end
 
+    # Raises BundlerAuditNotInstalled with an actionable message that
+    # includes stderr when available.
+    def raise_not_installed(stderr)
+      detail = stderr.to_s.strip
+      message = "bundler-audit could not be invoked. " \
+                "Ensure the `bundler-audit` gem is installed for this Ruby " \
+                "(#{RUBY_VERSION}) and run `bundle-audit update` to fetch the " \
+                "advisory database."
+      message += " stderr: #{detail}" unless detail.empty?
+      raise Errors::BundlerAuditNotInstalled, message
+    end
+
     # Maps a single bundler-audit finding onto the public schema.
     #
     # bundler-audit has used slightly different key names across versions, so

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: lockfile_audit
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - behnam1369